guloader | JaffaCakes118_bec7e500b8f6a1fd7cd42b0e7b5f7c6d12284461bf63255bd82710b4779c9f25 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

JaffaCakes118_bec7e500b8f6a1fd7cd42b0e7b5f7c6d12284461bf63255bd82710b4779c9f25
Size

860KB
MD5

225f8693a418811f2d40bb41d66a21f2
SHA1

07f43ab161a392a005d6066e064423a589f4ae42
SHA256

bec7e500b8f6a1fd7cd42b0e7b5f7c6d12284461bf63255bd82710b4779c9f25
SHA512

96bf9ac94eb4f7a4c7d833caec98b676a9b0078eaf4e809785daa384384f75ba84c6f859913b0cc57e96efbe07cb9882ee9d15f8b576a348e0c0fb7990fa9cbf
SSDEEP

3072:CNRCywDw1DpJzukemUN8fjvMvsemhxL/v1NpooYYYYYYYYYYJ41YYYYYYYYYYHue:CT4DmP9Uo4s9hxjaTuNM7Zy09m9aTpt

Score

10^/10

guloader

Malware Config

Signatures

Guloader family
guloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_bec7e500b8f6a1fd7cd42b0e7b5f7c6d12284461bf63255bd82710b4779c9f25

Files

JaffaCakes118_bec7e500b8f6a1fd7cd42b0e7b5f7c6d12284461bf63255bd82710b4779c9f25
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 236KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 406KB - Virtual size: 405KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ